Article thumbnail

An Efficient Technique for Preventing Mimicry and Impossible Paths Execution Attacks

By Danilo Bruschi, Lorenzo Cavallaro and Andrea Lanzi

Abstract

In this paper we propose a new strategy for dealing with the impossible path execution (IPE) and the mimicry attack in the N-gram based HIDS model. Our strategy is based on a kernel-level module which interacts with an underlying HIDS and whose main scope is to “randomize” sequences of system calls produced by an application to make them unpredictable by any attacker. We implemented a prototype of such a module on a Linux system in order to experimentally verify the feasibility and efficacy of our idea. The results obtained are quite encouraging, furthermore it turned out that our module is quite efficient, as it affected the performance of a testbed web server with a slowdown factor of only 5.9%.

Year: 2010
OAI identifier: oai:CiteSeerX.psu:10.1.1.169.3247
Provided by: CiteSeerX
Download PDF:
Sorry, we are unable to provide the full text but you may find it at the following location(s):
  • http://citeseerx.ist.psu.edu/v... (external link)
  • http://idea.sec.dico.unimi.it/... (external link)
  • Suggested articles


    To submit an update or takedown request for this paper, please submit an Update/Correction/Removal Request.